020 w hijackthis

[men01]

Mam problem z usunięciem jednego wpisu. Czy ktoś mi poradzi jak to ugryść ? prosze

O20 - Winlogon Notify: winuns32 - winuns32.dll (file missing)

[wojtas]

daj loga to usuniemy
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

[men01]

powód Wykryte 4 wiry.

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 21:43:38, on 2006-08-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
C:\Program Files\Common Files\{A07333A5-0BB8-1045-1106-030403030030}\Update.exe
D:\AD-AWA~1\Ad-Watch.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
D:\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
D:\Gadu-Gadu\gg.exe
D:\eMule\emule.exe
D:\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Mariusz\Bezpieczeństwo\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\taskbaricon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [c003efad.exe] C:\WINDOWS\system32\c003efad.exe
O4 - HKLM\..\Run: [KAVPersonal50] "D:\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKCU\..\Run: [AWMON] "D:\AD-AWA~1\Ad-Watch.exe"
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [c003efad.exe] C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\c003efad.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = D:\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O8 - Extra context menu item: Dodaj do Kaspersky Anti-Banner - D:\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD6D3EF7-4646-4734-832C-D95360E3ABE2}: NameServer = 194.204.152.34 217.98.63.164
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winuns32 - winuns32.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Usługa Kaspersky Anti-Virus (kavsvc) - Kaspersky Lab - D:\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[wojtas]

podaj przyczyne wklejenia loga co sie dzieje z kompem??

[jeff]

wyłącz przywracanie systemu, wejdź w tryb awaryjny i kasujesz wpisy w Hijacku

O4 - HKLM\..\Run: [c003efad.exe] C:\WINDOWS\system32\c003efad.exe
O4 - HKCU\..\Run: [c003efad.exe] C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\c003efad.exe
O20 - Winlogon Notify: winuns32 - winuns32.dll (file missing)

pogrubione pliki usuwasz recznie

[wojtas]

usuwasz z wylaczonym przywracaniem systemu w trybie awaryjnym:

C:\Program Files\Common Files\{A07333A5-0BB8-1045-1106-030403030030}\Update.exe
O4 - HKLM\..\Run: [c003efad.exe] C:\WINDOWS\system32\c003efad.exe
O4 - HKCU\..\Run: [c003efad.exe] C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\c003efad.exe
O20 - Winlogon Notify: winuns32 - winuns32.dll (file missing)

najpierw usuwasz wpsisy w hj potem pogrubione szukasz i wywalasz do kosza po zabiegach nowy log w razie problemow uzyj killboxa:
http://www.idg.pl/ftp/pc_8881/Pocket.KillBox.2.0.0.473.html